Two Florida cases suggest that if you really, truly can’t remember your iPhone or Android password, don’t hand over mumbo jumbo and then claim to have given the cops your password.

Case in point: Christopher Wheeler. He gave cops something he claims was his password, only to have them fruitlessly jab in characters without managing to unlock his phone.

The 41-year-old from Hollywood, Florida, was sentenced on Tuesday to 180 days in jail over the password/not-a-password. As the Miami Herald reports, he was convicted for contempt of court for failing to unlock his Android phone to authorities looking into a child abuse case.

Wheeler had been arrested on March 6 for aggravated child abuse, domestic violence and child neglect after detectives said he repeatedly assaulted his daughter, causing “severe bruising, swelling and scratches,” according to documents filed in Broward Circuit Court in Florida.

When he was arrested, police seized Wheeler’s Android smartphone. They’ve argued that it contains photographic evidence of the alleged crimes. They want to get at photos of the alleged crimes, but that passcode is locking them out. Wheeler was convicted on the contempt charge on May 12 and was sentenced to 180 days during a sentencing hearing Tuesday in Fort Lauderdale.

It will all go away once Wheeler forks over a password that works, Circuit Judge Michael Rothschild wrote:

Should defendant provide a password which unlocks the phone prior to sentencing or thereafter, the court will purge the contempt and vacate the sentence.

But I did give them my password, a distraught, handcuffed Wheeler told the judge, according to the Miami Herald:

Both Victor and Voigt have been ordered by a judge to produce passcodes to unlock their phones, where police suspect they’ll find text messages showing that the duo last year colluded to demand $18,000 from YesJulz in exchange for not leaking sex videos taken from her phone. YesJulz’s phone had mysteriously disappeared during a party that Voigt also attended.

Wesley Victor did not hand over a bowl of tangled noodles and claim that it was his passcode. Rather, as the Miami-Herald reports, he told the court that he simply didn’t remember the number.

In Pennsylvania, it was a “John Doe” who “forgot” the passwords needed to unlock external hard drives that the Justice Department believes contain child abuse imagery. Make that strongly believes: investigators had found the telltale hash values of known abuse images and presumed that those images had been downloaded to the external drives.

Doe had argued that he wasn’t in contempt of court because being forced to reveal his password violates his Fifth Amendment protection against self-incrimination. The thinking behind this frequently used (but not guaranteed) interpretation of revealing passcodes is that they’re something locked away in your brain, or what’s referred to as “something we know”. The police have had a much easier time with forcing people to unlock their phones with biometrics such as fingerprint swipes, given that our fingers are simply a part of us, and not something we know, and hence can’t be considered self-incriminating speech.

One example: in May 2016, government lawyers requested, received and executed a warrant to enter a building in Lancaster, California, to seize mobile devices, and to force anyone inside – or in the immediate vicinity – to use their fingerprints to unlock them.

But back to Pennsylvania and the “I forgot my passcode” John Doe who claimed the Fifth Amendment protected him from the self-incrimination of turning over the data in the first place. In short, it didn’t work out too well for him.

In August 2015, the magistrate judge said that Doe’s decrypting his devices couldn’t be considered testimony against himself, because the government already knew that there would be child abuse imagery on the devices.

That’s where the hashes that identified the child abuse images came in: investigators had spotted the tell-tale hashes, so John Doe wouldn’t be self-incriminating himself by handing over his passcode, the judge said. Rather, the DOJ already knew the images were there. Investigators might not have been able to find the actual images on John Doe’s Mac, but they did find evidence of Doe having allegedly downloaded thousands of files with the hash values of known child abuse images.

Victor, the Florida man accused of extorting the Queen of Snapchat, is the latest “I forgot my passcode” case. But he’s fared far better with the excuse than did John Doe in Pennsylvania.

As the Miami Herald reports, on Tuesday, Miami-Dade Circuit Judge Charles Johnson ruled that there was no way to prove that Victor actually remembered his passcode, given that more than 10 months had passed since his initial arrest. The judge therefore declined to hold Victor in contempt of court.

Victor’s lawyer, Zeljka Bozanic, said that he himself has holes in his memory about these things:

The judge made the right call. My client testified he did not remember. It’s been almost a year. Many people, including myself, can’t remember passwords from a year ago.

The ruling doesn’t mean the “I can’t remember” excuse for not handing over our passcodes is convincing, regardless of what Victor’s lawyer says. What’s more relevant is that a judge has said that there’s no way to prove whether Victor remembers or not.

As it is, Johnson had no concerns about abrogating Victor and Voigt’s Fifth Amendment rights against self-incrimination when he ordered them to turn over their passwords. What he said at the time of that order:

For me, this is like turning over a key to a safe-deposit box.

According to the Miami-Herald, both Wheeler and Victor were ordered to give up their passcodes under a decision from a Sarasota, Florida appeals court that allowed police to compel a passcode for a suspected video voyeur. The Florida Supreme Court has yet to take up the issue.

Readers, what would you do if law enforcement, or border patrol agents, demanded you turn over your phone passcode? Refuse? Claim to have forgotten? Something else entirely?

Please do share your thoughts in the comments section below. This is an area of data privacy that’s in constant in regarding American courts, and we’ll do our best to bring you the latest court cases, with all their twists and turns.

Post navigation

About the author

Lisa has been writing about technology, careers, science and health since 1995. She rose to the lofty heights of Executive Editor for eWEEK, popped out with the 2008 crash and joined the freelancer economy. Alongside Naked Security Lisa has written for CIO Mag, ComputerWorld, PC Mag, IT Expert Voice, Software Quality Connection, Time, and the US and British editions of HP's Input/Output.

18 comments on “Why ‘I forgot my password’ won’t go down well with a judge”

Border Patrol Agent – leave my smart phone at home and travel outside the U.S. with a burner phone for emergency use only. Upon re-entry, hand it over and let ’em keep it.
Inside America is much more interesting. If I am threatened with incarceration for refusing to relinquish my First Amendment right to privacy, I guess I’ll just have to make sure I get a good lawyer.

I know, let’s have a national ballot on this issue and a few other ones. That would be democracy. Oh, hang on, this is America – and the Supreme Court dictators would probably overrule the democratic majority. Maybe we need a (binding) national ballot on the Supreme Court dictatorship. Democracy is the rule of the democratic majority, not the lawyers.

Hang on, didn’t these people have something to hide?? Beating a child is less important than your privacy rights? I don’t agree with routine stop/search at all but they *knew* there was evidence on these devices.

It’s quite interesting. I would say you can never really prove that someone didn’t forget something. At most you can argue it’s reasonable to assume they didn’t forget. But proving without a doubt that someone knows something? So basically it’s all depending on whether or not the judge believes you really don’t remember. And if the judge doesn’t believe you and you really forgot a password, you are going to end in jail for a possibly very long time, because you forgot something.